Skip to main content

GCleaner

Malware Family

8 726 indicators of compromise attributed to GCleaner across abuse.ch threat intelligence feeds.

Domains

1

IPs

3

URLs

37

Hashes

8 685

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&Cpayload

Sample indicators

IndicatorType
gcl-page.bizdomain
91.92.241.242ip
158.94.209.95ip
195.24.237.47ip
http://45.12.253.74/pineapple.phpurl
http://91.92.241.242/infourl
http://hsiens.xyz/addInstall.phpurl
http://mazama.xyz/addInstall.phpurl
http://37.0.8.39/access.phpurl
http://91.92.241.242/successurl
http://91.92.242.236/serviceurl
http://appwebstat.biz/stats/1.phpurl
http://45.12.253.75/dll.phpurl
http://194.145.227.161/dlc/sharing.phpurl
http://158.94.209.95/updateurl
http://onlinehueplet.com/77_1.exeurl
http://45.12.253.56/advertisting/plus.phpurl
http://158.94.209.95/infourl
http://158.94.209.95/serviceurl
http://91.92.242.236/updateurl
http://cleaner-partners.ltd/stats/save.phpurl
http://158.94.209.95/successurl
http://45.12.253.72/default/stuk.phpurl
http://the-flash-man.com/Installer_HwtcxtRp5S8kqr2V9ysBB7Utrt/UltraMediaBurner.exeurl
a496cc7d34fa3d55696e16f2bbddad31b0eb5ce57dad0b0f5f6d92e485ae6829hash
8cc62674c053917f64cdabeb5c5d3f994d73deb566dbbfd68acf808243312143hash
ce7f8acbe181eef131aa586babe5b173279752dee598c758600f81d04ca53eb5hash
06b1f0c7bcebfc00a38b2fecc85de193cf598a7029196dd12bd1226e65db6b2ehash
614046c3410cd7f94a95008420a3b6ddc66b96ecf693644820461f0d50254e82hash
8b3db75d0c2d0bf0b6386f92b85c4d298db3b889hash
811508e75cf64edaa041cf72d6379488278bbf29e513b26a5f0f5654a0a15cbchash
b7c1023963399dbf2f6954ea1ab3e3861193df946d7abf8e44510b05590daeafhash
1b9e5612545c84e9de6576436dd875b2b529e128fcb50b77a988ccc9985e2109hash
6e9cdfa6e7f7f2fe741679e01c3bfd9ca484ad59d0de9fa66b4c27a3ab57b92dhash
88fd0a94701b9fe6d5f97030a170a72bdae6570623aad84b7fb315e6317b0401hash
6bfc463f800c95aa5e4427869134b338a914e4caaccd171bef86385befbaa645hash
e9b7c7b03d379e1399e3611040fc5c5a0af3085d438689fd468acda5fdd6bf54hash
41609a21e31c6079bce874ffd7f126f71c4d07348ed38214ba6bbcef5be828e2hash
78eb472a3f7381304ce6783ce46fcbfd96937bf884e663338f721d610e9ee5f8hash
9f7697723133db0c2a54d47a9085629c1f786e449501e37c63ef93ec0ed95ddbhash
8b2d9358a329089c3bd96cce97b91e9b8a4d900abd0aaa8e55c3c0466e930c88hash
c67b927be27cabd21373255d0131c468137823e2d29bb1d2223501a2ee4621ebhash
687a003fd3d125b452accd657fd0ca30c9df82ede6ef4a314b06977fae905909hash
e6b84ffaaeb4807ccac7c778f87d0b3545841e076063c8f594141430f791f0bchash

Another file to check? Run a file hash reputation check.